Deloitte welcomes the opportunity to comment on the Direct Marketing Code Draft Code published 
by Information Commissioner’s Office (ICO) on 8 January 2020. 


General points 


1. We would appreciate some further clarification and specificity in the guidance around B2B 
marketing (where we mostly work). There may be a distinct difference in the “harms” that 
may occur to individuals in a business to consumer relationship as opposed to a business to 
business relationship. 


2. We’d appreciate more detail and specificity when it comes to B2B application of the rules, 
and use of legitimate interests as our lawful basis. Much of the content here revolves 
around situations of consent. 


3. We think it’d be worthwhile focussing some of the language in the document, so there’s no 
room for misinterpretation. As an example (on page 7), the guidance states “You will be 
caught by the direct marketing rules...” It may be clearer to say ‘covered’ or ‘you need to 
comply with’. 

4. We feel it’d be worth explaining exactly which organisations are covered by this guidance up 
front. We have read this as ‘anyone who markets’ but are fairly developed in our thinking 
and understand concepts such as ‘data protection by design’. We wonder if smaller 
businesses are in the same position however, which may make this document feel daunting 
and challenging to navigate. Would there be any value in adding a decision tree/similar to 
help guide businesses to the applicable portions for them? 


Specific points 
1. Section on online advertising and new technologies 


a. Page 87 talks about observed and inferred data and the need to be transparent with 
data subjects. We are not aware of any way that we can collect such data via the 
platforms we use for social media (most notably LinkedIn and Facebook), therefore, 
have no opportunity to be transparent (by way of a privacy notice/similar) about our 
processing as it’s not functionality that exists. 


b. Where we use targeted advertising on social media platforms, we are not collecting 
any data from this. The data subject needs to be aware of how their activity has 
enabled the social media platform to process their data, and how they have 
addressed an advertisement to them. As a marketer using such a facility, we have 
no control over these elements. 


c. Page 88 talks about cookies used for direct marketing purposes. Can it be made 
clearer whether this is cookies on our own website, or the cookies used on social 
media platforms? If we market through social media platforms, we have no control 
over cookies they use on their own sites. 


d. We’d appreciate clarification on whether there’s any specific guidance on the use of 
insight tags? As far as we’re aware they have no functionality to be explicit from the 
marketer’s side, but perhaps they do from the point of view of the social media 
platform, but equally we receive no PII from these. 


e. Page 91, second complete paragraph ends ‘you need to be very clear...’. We weren’t 
sure who we were being clear with (the data subjects?) and how? This paragraph 
feels like it needs some expansion. 


Page 92, asked that we exclude people on our suppression list from marketing on 
social media. Unfortunately the social media platforms do not provide functionality 
to enable us to exclude individuals from our advertising, as this advertising is based 
on the social media platform’s analysis of their subscribers’ behaviour. We don’t see 
the personal data at all in this scenario. We’d recommend that the platform 
provides more detailed information to the data subject on why they are receiving 
certain advertising, allowing them to opt out via the platform/tailor their advertising 
preferences accordingly. Obviously if we ever did run a list-based campaign, we 
would exclude anyone on our suppression list. 


Page 53 also states: “an individual may want as many people as possible to read 
their social media post but that does not mean they are agreeing to have that data 
collected and analysed to profile them to target your direct marketing campaigns. 
Likewise just because an individual’s social media page has not been made private 
does not mean that you are free to use their personal data for direct marketing 
purposes”. We want to make sure it’s clear that the way the platforms operate 
means that we don’t collect their personal data (not on the platforms we use) for 
marketing. Any advertising is targeted by the social media provider, based on 
parameters we set. Where we utilise functionality such as forms to collect 
information from interested parties, we use appropriate data protection measures 
such as privacy notices. 


Overall, when it comes to online advertising and new technologies, we’d like to see 
dedicated guidance produced for the technology/platform providers themselves 
(such as Facebook and LinkedIn), and for data subjects on how they navigate the use 
of their data on such sites. 


2. Working collaboratively with other businesses 


a. 


There are many situations where we work in conjunction with another organisation 
to market (ie to host an event, or produce a publication, or organise a conference) 
however this joint-working arrangement doesn’t feature greatly in the guidance. 
We’d be interested to hear if there are any particular regulatory considerations to 
take into account when it comes to how data is processed between multiple bodies. 


Is the draft code clear and easy to understand? 


x] 


Yes 


No 


If no please explain why and how we could improve this: 


See our General Points 3 and 4 above, regarding use of language and the ability of organisations — particularly 
smaller ones — to appreciate the content in the document. 


Q2 Does the draft code contain the right level of detail? (When answering please remember 
that the code does not seek to duplicate all our existing data protection and e-privacy guidance) 


x] 


Yes 


No 


If no please explain what changes or improvements you would like to see? 


We’d appreciate greater detail on B2B marketing, and further clarification per our Specific Points above. 


If there are other relevant guidances produced regarding social media and the division of responsibility across 


the marketer, the platform, and the data subject, we think this should be more clearly referenced. 


Q3 Does the draft code cover the right issues about direct marketing? 


Yes 
xX No 
If no please outline what additional areas you would like to see covered: 


We’d like to see more coverage of the potential harms to the corporate subscriber in the B2B marketing 
environment. 


Q4 Does the draft code address the areas of data protection and e-privacy that are having an impact 
on your organisation’s direct marketing practices? 


Xl Yes 


No 


If no please outline what additional areas you would like to see covered 


Q5 Is it easy to find information in the draft code? 


Yes 


X No 


If no, please provide your suggestions on how the structure could be improved: 


See point 4 of our General Points, suggesting a decision tree/similar structure to signpost relevant content. 


Q6 Do you have any examples of direct marketing in practice, good or bad, that you think it would be 
useful to include in the code 


Yes 


X No 


If yes, please provide your direct marketing examples : 


Q7 Do you have any other suggestions for the direct marketing code? 


None, barring points made initially in this document. 


ABOUT YOU 


Q8 Are you answering as: 


An individual acting in a private capacity (eg someone providing their 
views as a member of the public) 


[] An individual acting in a professional capacity 


On behalf of an organization 


Other 


Please specify the name of your organisation: 


Deloitte 


If other please specify: 


Ee 


Q9 How did you find out about this survey? 


ICO Twitter account 

ICO Facebook account 

ICO LinkedIn account 

ICO website 

ICO newsletter 

ICO staff member 

Colleague 

Personal/work Twitter account 


Personal/work Facebook account 


H UIC E SES) (GE) SEEN GE aa G Fife] 


Personal/work LinkedIn account 


Other 


If other please specify: 


Direct Marketing Association 


Direct Marketing Association 


Thank you for taking the time to complete the survey 


